Dear Professional, I have a Search string like below index="hcg_oapi_prod" relatedPersons | regex "\"relatedPersons\":\[\]" And this is the result   The result have to type: Type 1: Results has value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"} Type 2: Results dose not have value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"} How can I filter results for type 2 only? (dose not have value {"name":{"firstName":"xxx","middleName":"xxx","lastName":"xxx"}) Thank you. ... View more

Dear professional,  I have a search like this index="hcg_oapi_prod" relatedPersons And the search value is store in attached image. Then, I want to add a filter to search the log that have "relatedPersons":[] only, like this 2022-02-28 13:18:24.253 [c8058db8c5664bd1b3c49b749b607df8/c8058db8c57dcac5] - DEBUG OncePerRequestFilter - obtained request content: {"offerCode":"aaaa","application":{"applicantPerson":{"name":{"firstName":"aaa","middleName":"aaa","lastName":"aaa"},"gender":"MALE","birthDate":"1aaa","addresses":[],"phoneNumbers":[{"phoneType":"PRIMARY_MOBILE","number":"11111","verificationID":"ascve"}],"identificationDocuments":[{"type":"ID_CARD","number":"2222"}]},"additionalDocuments":[{"documentType":"PHOTO_PERSON","documentInfo":[],"photoTakingResult":"TECHNICAL_PROBLEM"},{"documentType":"MEDICAL_INS_CARD","documentInfo":[{"type":"INSURANCE_CARD_NUM"}]},{"documentType":"BANK_STATMENT_3","documentInfo":[{"type":"BANK_ACCOUNT_NUM"}]}],"employmentInfo":{"econimicalStatus":"OTHER","monthlyIncome":{"amount":8000000.0,"currency":"VND"},"monthlyPaymentLoan":{"amount":0.0,"currency":"USD"}},"relatedPersons":[]},"userStatistics":[{"key":"tongdun_appname","value":"HomeCredit_vn_and"},{"key":"tongdun_blackbox","value":"eyu"},{"key":"tongdun_source","value":"dqshand"},{"key":"tracksessionid","value":"0459588f-b583-4cf0-954c-8ecbbcc31a8e_16460289063825295"}]} Please help me. ... View more

Dear Professor, I have two alert search like this 1. Search 1: index="abc" sourcetype="abc" service.name=financing request.method="POST" request.uri="*/applications" response.status="200" |timechart span=2m count as applicaton_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") |fields _time,yesterday_time,applicaton_today And here is output 2. Search 2: index="xyz" sourcetype="xyz" "Application * sent to xyz success" |timechart span=2m count as omni_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") |fields _time,yesterday_time,omni_today And here is output  3. I try to combine two search like this then calculate spike. index="abc" sourcetype="abc" service.name=financing request.method="POST" request.uri="*/applications" response.status="200" |timechart span=2m count as app_today |eval mytime=strftime(_time,"%Y-%m-%dT%H:%M") |eval yesterday_time=strftime(_time,"%H:%M") | append [search index="xyz" sourcetype="xyz" "Application * sent to xyz" | timechart span=2m count as omni_today] |fields _time,yesterday_time,app_today,omni_today |eval spike=if(omni_today < app_today AND _time <= now() - 3*60 AND _time >= relative_time(now(),"@d") + 7.5*3600, 1, 0) Here is output  But it shows two time span (like image).  How can I combine two search with only time span like this.   Thank you for your help.     ... View more

Hi I write the Splunk query below to monitor server log index="abc" sourcetype="abc" login "response.status"=200 source="abc.log" | timechart span=2m count | timewrap d series=short | addtotals s* | eval daysAvg=round(Total/14.0,0) | eval yesterday_time=strftime(_time,"%H:%M") | table _time, yesterday_time, s0, daysAvg,s6 | outputlookup openapi_login_last_days_lam.csv   However, my query is rely on time range to count daysAvg value, for example in this case time range is 14 day so eval daysAvg=round(Total/14.0,0). I want to calculate daysAvg dynamic. That means I don't need to change time range value when I apply other range. To achieve that, I wrote code to calculate time range like this index="abc" sourcetype="abc" login "response.status"=200 source="abc.log"    | stats earliest(_time) as earliest_time    | eval latest_time=now()    | eval difference=floor((latest_time-earliest_time)/(3600*24))    | table earliest_time, latest_time, difference   Finally, I combine two search like this index="abc" sourcetype="abc" login "response.status"=200 source="abc.log" | timechart span=2m count | timewrap d series=short | addtotals s* | append     [ search index="abc" sourcetype="abc" login "response.status"=200 source="abc.log"         | stats earliest(_time) as earliest_time         | eval earliest=earliest_time     ] | eval latest_time=now() | eval daysAvg=round(Total/14.0,0) | eval yesterday_time=strftime(_time,"%H:%M") | table _time, yesterday_time, s0, daysAvg, s6, latest_time, earliest   But earliest from subsearch did not pass to outer search. Please help me. Thank you ... View more